42 U.S.C. § 405b — Reducing identity fraud

(a) Purpose. This section aims to cut down on synthetic identity fraud (fraud that combines real and fake information to invent a fake identity), which especially hurts vulnerable people like minors and recent immigrants. It does this by letting "permitted entities" check "fraud protection data" against a database the Commissioner keeps, once the consumer has given electronic consent. (b) Definitions. "Commissioner" means the Commissioner of the Social Security Administration. "Financial institution" has the meaning given in section 509 of the Gramm-Leach-Bliley Act. "Fraud protection data" means, together: a person's name, their Social Security number, and their date of birth. "Permitted entity" means a financial institution, or a service provider, subsidiary, affiliate, agent, subcontractor, or assignee of one. (c) Efficiency. The Commissioner must study whether an existing database (or similar resource) from before May 24, 2018, can be adjusted to meet this section's goals and the requirements in subsection (d). The Commissioner must then make those changes — or build a new database or resource — so those requirements are met. (d) Protection of Vulnerable Consumers. The database or resource must: (1) compare the fraud protection data submitted in a request against what the Commissioner has on file, to confirm or not confirm it's accurate; (2) be able to scale up to handle expected request volumes, with reasonably reliable uptime; and (3) let permitted entities submit either (A) single real-time electronic requests with immediate machine-to-machine answers, or (B) batches of requests, answered electronically within a reasonable time — no more than 24 hours. (e) Certification Required. Before confirming any fraud protection data for a permitted entity, the Commissioner must get a signed certification from that entity, no more than 2 years old, stating: (1) it is a permitted entity; (2) it complies with this section; (3) it complies, and will keep complying, with the privacy and data-security rules in title V of the Gramm-Leach-Bliley Act, for information it gets from the Commissioner; and (4) it will keep records proving its compliance for at least 2 years. (f) Consumer Consent. (1) A permitted entity may only submit a request if: (A) the individual gave written (including electronic) consent, and (B) the request relates to a credit transaction or a situation described in section 1681b of title 15. (2) To use electronic consent, the entity must get the person's electronic signature, as defined in section 7006 of title 15. (3) No other law — including the Privacy Act (section 552a of title 5) — can block the use of electronic consent for this purpose, or for other consent-based checks the Commissioner allows. (g) Compliance and Enforcement. (1) The Commissioner may audit and monitor permitted entities, to make sure the database is used properly and to catch fraud or misuse, and may cut off service to any entity that blocks these audits. (2) Violations of this section, or of an entity's certification, are enforced the way section 505(a) of the Gramm-Leach-Bliley Act enforces violations — by the same agencies listed there. If an audit uncovers a violation, the Commissioner must send the relevant information to the right enforcement agency. (h) Recovery of Costs. (1) All money spent to run this program must be fully recovered from the entities that use the database — through advance payments, reimbursements, user fees, or similar means, set by the Commissioner. That recovered money goes into the Social Security Administration's account and can be used, without a yearly time limit, to run this program. The Commissioner sets and periodically adjusts the prices charged, to make sure they always cover the full cost. (2) The Commissioner cannot start building a verification system until at least 50% of the program's start-up costs have been collected. (3) The Commissioner may use funds set aside for information-technology modernization to help build this system. (4) The Commissioner must report each year to the House Ways and Means Committee and the Senate Finance Committee on the SSA's indirect costs from running this program.